CycloneDX JSON is the format most SBOM tools emit by default (syft, cyclonedx-cli, the cyclonedx-npm/maven/gradle plugins), and the format Threat Detective itself exports. Any document declaring "bomFormat": "CycloneDX" is accepted.
Upload
From the project's SBOMs tab, click Upload SBOM, drop the file, and confirm. The import runs in the background and shows live progress. See Import your first SBOM for the stages.
By default Threat Detective works out what to do with the file: the software item name and version come from the SBOM's metadata.component, so a new component version becomes a new version of the matching software item, and an unfamiliar name becomes a new software item.
Choosing the import mode yourself
The upload button's menu offers three explicit modes when you want to override the automatic behaviour:
Upload as new software item: always create a fresh software item, even if the name matches an existing one.
Upload as new version: add this SBOM as a new version of a software item you pick.
Replace pre-release SBOM: overwrite the components of an existing pre-release version, for example as your release candidate evolves. Findings you've already triaged are preserved where components still match, and the import summary shows the preserved and archived counts.
Only pre-release versions can be replaced. Released SBOMs are immutable evidence. If you try to replace one, the import fails with a clear message; cut a new version instead.
What the file must contain
A
metadata.componententry (this names your software item and version).At least one component, and at most 50,000.
Valid JSON, up to 50 MB.
Most generator tools include all of this by default. If your upload is rejected, Troubleshoot a failed or incomplete import lists the exact messages and what they mean.